Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Trend Micro Control Manager 6.0 lets attackers run code

CVE-2017-11389 · published 9 years ago
Summary

The 6.0 version of Trend Micro Control Manager can be tricked into placing files in a public web folder, which then lets a remote attacker execute their own code on the server. This could lead to unauthorized access, data theft, or further compromise of your network. Update to the latest patched version or apply the vendor's recommended mitigation as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
trendmicro control_manager 6.0
cpe:2.3:a:trendmicro:control_manager:6.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.
Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
27% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published2 Aug 2017
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2017-11389 · NVD
Track software like this
Free during beta